HP Ilo 3 User Guide

2.Verifythatatrustedcertificateisinstalled.
UsingiLOinFIPSModewiththedefaultself-signedcertificateisnotFIPScompliant.For
instructions,see“ObtainingandimportinganSSLcertificate”(page49).
IMPORTANT:SomeinterfacestoiLO,suchassupportedversionsofIPMIandSNMP,are
notFIPScompliantandcannotbemadeFIPScompliant.ForinformationabouttheiLOfirmware
versionsthatareFIPSvalidated,seethefollowingdocument:http://csrc.nist.gov/groups/
STM/cmvp/documents/140-1/140-1val.zip
3.Powerofftheserver....

ConfiguringiLOforHPSSO
1.NavigatetotheAdministration→Security→HPSSOpage,asshowninFigure26(page62).
Figure26Security–SingleSign-OnSettingspage
2.MakesureyouhaveaniLOlicensekeyinstalled.
3.EnableSingleSign-OnTrustModebyselectingTrustbyCertificate,TrustbyName,orTrust
All.
TheiLOfirmwaresupportsconfigurabletrustmodes,whichenablesyoutomeetyoursecurity
requirements.ThetrustmodeaffectshowiLOrespondstoHPSSOrequests.Ifyouenable
supportforHPSSO,HPrecommendsusingtheTrustbyCertificatemode.Theavailablemodes
follow:...

4.ConfigureiLOprivilegesforeachroleintheSingleSign-OnSettingssection.
WhenyoulogintoanHPSSO-compliantapplication,youareauthorizedbasedonyourHP
SSO-compliantapplicationroleassignment.TheroleassignmentispassedtoiLOwhenSSO
isattempted.Formoreinformationabouteachprivilege,see“ManagingiLOusersbyusing
theiLOwebinterface”(page32).
SSOattemptstoreceiveonlytheprivilegesassignedinthissection.iLOdirectorysettingsdo
notapply.Defaultprivilegeassignmentsareasfollows:
•User—Loginonly...

Table4HPtrustedcertificatestatus
DescriptionIcon
Therecordisvalid.
ThereisaproblemwiththetrustsettingsortheiLOlicense.Possiblereasonsfollow:
◦ThisrecordcontainsaDNSname,andthetrustmodeissettoTrustbyCertificate(only
certificatesarevalid).
◦TrustNone(SSOdisabled)isselected.
◦Avalidlicensekeyisnotinstalled.
Therecordisnotvalid.Possiblereasonsfollow:
◦Anout-of-datecertificateisstoredinthisrecord.Checkthecertificatedetailsformore
information.
◦TheiLOclockisnotsetorissetincorrectly....

ExtractingtheHPSIMservercertificate
YoucanusethefollowingmethodstoextractHPSIMcertificates.
•Enteroneofthefollowinglinksinawebbrowser:
ForHPSIMversionsearlierthan7.0:
http://:280/GetCertificate
◦
https://:50000/GetCertificate
◦ForHPSIM7.0orlater:
http://:280/GetCertificate?certtype=sso
https://:50000/GetCertificate?certtype=sso
NOTE:Allrequestparametersarecase-sensitive.Ifyoucapitalizethelowercase
certtypeparameter,theparameterwillnotberead,andHPSIMwillreturnthedefault...

TochangetheRemoteConsoleComputerLocksettings:
1.NavigatetotheAdministration→Security→RemoteConsolepage,asshowninFigure27(page
66).
Figure27RemoteConsoleComputerLockSettings
2.ModifytheRemoteConsoleComputerLocksettingsasrequired:
•Windows—UsethisoptiontoconfigureiLOtolockamanagedserverrunningaWindows
operatingsystem.TheserverautomaticallydisplaystheComputerLockeddialogbox
whenaRemoteConsolesessionendsortheiLOnetworklinkislost.
•Custom—UsethisoptiontoconfigureiLOtouseacustomkeysequencetolockamanaged...

Table5RemoteConsoleComputerLockkeys(continued)
xc-BREAK
yd.BACKSPACE
ze/NUMPLUS
f0NUMMINUS
3.ClickApplytosavethechanges.
ConfiguringtheIntegratedRemoteConsoleTrustsetting(.NETIRC)
The.NETIRCislaunchedthroughMicrosoftClickOnce,whichispartoftheMicrosoft.NET
Framework.ClickOncerequiresthatanyapplicationinstalledfromanSSLconnectionbefroma
trustedsource.IfabrowserisnotconfiguredtotrustaniLOprocessor,andtheIntegratedRemote
ConsoleTrustsettingissettoEnabled,ClickOncedisplaysthefollowingerrormessage:
Cannot...

1.NavigatetotheAdministration→Security→LoginSecurityBannerpage,asshowninFigure29
(page68).
Figure29Security–LoginSecurityBannerSettingspage
2.SelecttheEnableLoginSecurityBannercheckbox.
iLOusesthefollowingdefaulttextfortheLoginSecurityBanner:
This is a private system. It is to be used solely by authorized
users and may be monitored for all lawful purposes. By accessing
this system, you are consenting to such monitoring.
3.Optional:Tocustomizethesecuritymessage,enteracustommessageintheSecurityMessage...

4.ClickApply.
Thesecuritymessageisdisplayedatthenextlogin,asshowninFigure30(page69).
Figure30Securitymessageexample
ConfiguringiLOnetworksettings
UsethetabsontheNetworkpagetoviewandconfiguretheiLOnetworksettings.
YoumusthavetheConfigureiLOSettingsprivilegetoviewandchangethesesettings.
Viewingnetworksettings
Toviewasummaryoftheconfigurednetworksettings,selectNetwork→iLODedicatedNetwork
PortorNetwork→SharedNetworkPorttonavigatetotheNetworkSummarypage.SeeFigure31
(page70).
ConfiguringiLOnetworksettings69 

Figure31NetworkSummarypage(iLODedicatedNetworkPort)
TheiLOSharedNetworkPortandtheiLODedicatedNetworkPortcannotoperatesimultaneously.
IfyouenabletheiLODedicatedNetworkPort,youwilldisabletheiLOSharedNetworkPort.If
youenabletheiLOSharedNetworkPort,youwilldisabletheiLODedicatedNetworkPort.
TheNetworkSummarypagefortheinactiveportdisplaysthemessageiLO is not configured
to use this NIC.
Thesummaryinformationfollows:
•NICinUse—ThenameoftheselectediLOnetworkinterface(iLODedicatedNetworkPortor
SharedNetworkPort)....